If you find that the ransomware is proven and you have no way of recovering backups in the first place, start setting up a restricted crisis cell and begin a clear and defined communication process with your employees.

As a first step, have the compromise assessed by an IT professional.
If the compromise is confirmed and is financially important, contact your cybersecurity insurance company.

Cyber insurance will assist you in the process and will connect you with the following professionals:

• Lawyers: Making sure everything is done legally
• Mandate an authorized ransomware negotiation firm
• Mandate a forensic team to determine the origin of the attack, the perpetrators and responsibilities
• An on-site technical team to operate, support and reassemble the infrastructure as required

Here’s what cyberinsurance may require:

• Authorities’ report
• Testimony of the individual who witnessed the compromise
• Installation of tools such as EDRs
• Logging of all interventions from the beginning to the end of the remediation process

Firstly, a forensic company will gather information to determine in detail all the actions that were carried out before, during and after the attack, by means of event logs, EDR reports, system audits, etc…

They usually do not require human testimony, as it is unreliable and inaccurate compared to the information provided by systems.

Secondly, once the analysis has been carried out, a report will be provided to the customer, the insurance company and the lawyers to determine the causes of the attack, who is responsible and the extent of the damage.
By default, no one is singled out, but rest assured that one or more responsible parties are needed to determine the amount of compensation.

Depending on the legislation, a declaration of the incident will be required.
In Quebec, for example, Bill 25 requires that the incident be reported to the Commission d’Accès à l’Information, and that all reasonable and necessary prevention measures be taken BEFORE the attack
In addition, all incidents must be recorded in the company’s incident register.

In conclusion, if no action had been taken, you risk onerous fines and the obligation to subscribe to a one-year personal data protection policy for all employees (present AND past).

That’s where we come in. Your company needs to be able to resume operations as quickly as possible.
This must be done without damaging the analysis in progress, and without creating further problems.

In other words, Aostral will assess the compromised systems and data, and propose a recovery project. In most cases, your insurance will cover these costs.

Before the situation returns to normal, it is essential to setup the tools needed to prevent a recurrence (EDR, antispam, MFA, etc.). Other context-specific actions, such as reviewing access management, will also be required.

Once the security of the infrastructure has been guaranteed, the backups can be restored. This stage takes place under the supervision of security teams, to ensure that data is not compromised again.
In the extreme case where the ransom has to be paid (no valid backups), the authorized trading company will be responsible for the transactions.

In conclusion, prevention is better than cure, and this applies to ransomware.

• Cybersecurity insurance is essential.
• Good EDR anti-virus security is the minimum.
• Good anti-spam security too
• Ensuring staff are trained and made aware of safety issues
• Ensure immutable backups on an external site (3-2-1-1-0 principle)
• Limit virtual access to infrastructure and data as much as possible (protection of intellectual patents, personal and financial data, etc.).
• Limit physical access to buildings (social engineering attacks are little-known but devastating)
• Perform regular penetration tests with an effective Red Team such as Yack
• Have a defined process in the event of a cyberattack (DRP, BCP, with RPO/RTO assessment)